Hange Confirms Hashed Password and Payment-Data Records Leaked1
ENSAPIA Tokyo says a third party gained unauthorized access to servers supporting its Hange online-game portal and that some customer personal information leaked externally.1 In a bounded review of the complete multi-report page capture at the reporting cutoff, we found per-field counts but no published unique-person total.1
SECURITY NOTICE • Reporting cutoff: November 13, 2026, 8:17 AM EST / 2026-11-13T13:17:13Z
The bottom line
The confirmed data includes 61,962 hashed-password records and separate payment-data categories, including 2,961 masked partial card-number records and six security-code records.1 The notice presents the masked partial-card-number and security-code counts as separate field entries.1
Verified facts
What happened
ENSAPIA says it detected possible external unauthorized access to Hange servers on November 3, blocked the affected communication path during emergency maintenance and began investigating.1 The investigation confirmed that some customer personal information leaked.1 The company identifies third-party unauthorized access as the cause, while saying details remain under investigation.1
Records confirmed in the notice
The notice lists a separate count for each disclosed field.1
| Category | Confirmed records |
|---|---|
| Hashed passwords | 61,9621 |
| Member email addresses | 51,0251 |
| Birth dates | 28,2511 |
| Names, addresses, postal codes and phone numbers | 2,9941 |
| Email addresses used as external-service IDs | 36,5451 |
| Masked partial card numbers | 2,9611 |
| Card security codes | 61 |
| Payment phone numbers | 971 |
| Cardholder names | 21 |
| Other email addresses | 971 |
Why it matters
The notice identifies 61,962 disclosed records as hashed passwords.1 ENSAPIA says the confirmed leaked information alone cannot enable fraudulent card use; it still asks customers to check statements for unfamiliar charges or withdrawals.1 The notice lists six security-code records and 2,961 masked partial-card-number records as separate field entries.1
What this means for readers
- If you reused the same password elsewhere, change it there: ENSAPIA asks users who reused the same password on another service to change it promptly.1
- Distrust breach-themed unsolicited contact: ENSAPIA says not to open attachments or click URLs in suspicious messages claiming to come from the company or related authorities, and asks recipients to delete those messages promptly.1
- Monitor statements: Check for unfamiliar charges or withdrawals; if you find a credit-card charge you need to dispute, CFPB guidance says to call the card company and report the problem right away.13
What remains unknown
Intrusion details: ENSAPIA says details remain under investigation.1
People affected: In our bounded review of the complete multi-report page capture at the reporting cutoff, we found no published unique-person total.1
Reopening: ENSAPIA says reopening is expected to take time.1
How we know
The primary evidence is the November 13 fourth Hange report.1 ASCII’s English page is an AI-translated downstream summary that points readers back to the original Japanese article; it is supporting reporting, not independent forensic confirmation.2
Sources
- ENSAPIA Tokyo: Hange unauthorized-access notice, fourth report — updated November 13, 2026, 2:00 p.m. JST.
- ASCII.jp English Edition: Hange breach report — November 13, 2026; AI-translated downstream reporting, not independent forensics.
- Consumer Financial Protection Bureau: disputing a credit-card charge — reviewed April 15, 2024.
Update and correction note: This report is bounded to the cited sources and reporting cutoff; unresolved facts are labeled rather than estimated.